Validating and Updating runZero Asset Sync

Building and releasing a new version

1. Install Splunk Enterprise for local testing:

   • Enterprise Free Trial: https://www.splunk.com/en_us/download/splunk-enterprise.html

2. Install uv if you don't already have it: brew install uv.

3. Bump the version in ucc/package/app.manifest (info.id.version) if this is a new release.

4. Build and package the add-on:

./scripts/build.sh

This produces TA_runzero_asset_sync-<version>.spl in the repo root. Always use this script rather than running ucc-gen build/ucc-gen package manually -- see the "case preservation" comment block inside scripts/build.sh for why.

5. Install the .spl in local Splunk Enterprise ("Manage Apps" → "Install app from file") and smoke-test it (see testing notes in docs/testing.md).

6. Run the local AppInspect checks (see below) and confirm no new error/failure/ future_failure results before uploading.

7. In Splunkbase, go to our app (https://splunkbase.splunk.com/app/6549)

   • The below seems to change with some regularity. If you come across a difference in the release process, please note it for future maintainers.
   • Select "Manage App"
     • You may need to be added to manage the app, ask a team member for help if needed.
   • On the version listing, select "Create new release" and upload the .spl.
   • Once this passes basic validation, "Save and continue".
   • Full AppInspect runs now
     • Once that runs, "Save and continue".
   • Populate release notes
     • "Updated version compatibility" or similar should be fine.
     • Select all versions (9.0 - 10.X) for compatibility.
     • Select no CIM versions for support.
     • "Save and continue"

Running Splunk Cloud vetting (AppInspect) checks locally

Splunkbase's Cloud compatibility notices (e.g. "Action required: ... will lose Splunk Cloud Platform compatibility") are generated by Splunk AppInspect. To reproduce and verify fixes for these checks locally, this repo includes a standalone appinspect/ project, plus scripts/check.sh, which drives the workflow.

1. Run the checks:

./scripts/check.sh

2. Re-run after making changes to confirm a check's result flips to success. Repeat this workflow for any future Splunkbase Cloud compatibility notice before uploading a new release.